But this is not a quantitative risk assessment (QRA). It is not even "semi-quantitative". It is a qualitative risk assessment which uses numbers to prioritise and aid decision-making. The same result could be achieved with a coloured grid (refer to the risk assessment matrix in this article).
Let's consider two types of data. Ordinal data provides a rank order. In a race, you came first, she came second, and I came third. You were faster than her and me, but the order tells you nothing about how much faster you were -- I might have been seconds behind or weeks behind. If you use a ratio scale, you know how the numbers relate to each other. If I weigh 60 kg and you weigh 80 kg, I can say that you weigh 20 kg more than me, and that you are 25% heavier than me.
For a QRA you need ratio data, such as how many times a valve has failed in use. You also need a model of how you think accidents occur, how you expect barriers to prevent or contain the accidents, and how they can fail. This model is often provided using tools, such as fault trees, to show how events combine to create a failure and event trees to look at other outcomes after a failure.
For simplicity, consider an accident with no branching causes. Imagine that a slip accident is the result of just two calculations: the probability of a slip hazard occurring and the probability that, on encountering it, someone is unable to prevent themselves slipping. Reviewing 120 workplace inspections, we find that slip hazards were identified 20 times, so we assume the probability of an occurrence is one in six. Looking at 30 incident reports for slips and trips we find that 25 were near-misses, and five resulted in falls and injuries so, again, we assume the probability is one in six. Multiply the two probabilities, and the likelihood of an accident is one in 36. It would be like having two six-sided dice, and determining that the probability of an accident is the same as the probability of throwing two fours.
Unfortunately, QRA in practice is less straightforward than this. If you had a fair die, you would know that the probability of a four was one in six. However, in this case we are estimating the probability on the basis of observations. The more observations, the more confidence you might have in your estimate, but it is still an estimate. It would be like seeing the numbers on the top of a die, but not knowing how many sides it had. For some QRAs a model is run thousands of times, with different estimates for hundreds of variables, to produce a picture over time of how often the outcomes will be for those we consider unacceptable.
It would be like having two six-sided dice, and determining the probability of an accident is the same as the probability of throwing two fours
In practice, QRAs are required only for major hazards, such as offshore oil and gas, nuclear, chemical and transport of hazardous goods, where the purpose is to show that risks are tolerable.
In Reducing Risks, Protecting People (2001), the UK Health and Safety Executive sets an upper limit for tolerable risks at one in 1,000 a year for workers, and one in 10,000 a year for the public. If a QRA can show that the upper (worst) estimate of risk is below these limits, the task can proceed without further controls.
In most cases, occupational safety and health professionals are carrying out risk assessments not to prove something is tolerably safe, but to identify where we can improve risk management "so far as is reasonably practicable". In most cases, we don't have enough reliable data for QRA. Rather than sticking numbers on to categories and mistakenly calling assessments quantitative or semi-quantitative, we should be proud of producing high-quality qualitative risk assessments.